Social Engineering Testing Services
Over 90% of successful cyber attacks start with a human being making a mistake. Phishing emails,
fraudulent phone calls, and social manipulation are the primary tools attackers use to breach even
the most technically secure organisations. Intrix Cyber Security’s social engineering testing measures your
organisation’s human risk and gives you the data to reduce it.
What Is Social Engineering Testing?
Social engineering testing simulates the techniques real-world attackers use to manipulate people into revealing credentials, transferring money, installing malware, or granting access to systems. We design
and execute realistic campaigns that test your employees across multiple attack channels — from email phishing to phone-based vishing to in-person pretexting.
Unlike generic phishing simulators, our campaigns are custom-crafted using open-source intelligence (OSINT) gathered about your organisation, making them indistinguishable from real attacks.
Types of Social Engineering Testing
Vishing (Voice Phishing)
Our testers call employees using scripted pretexts to extract sensitive information, credentials, or remote access. Common scenarios include IT help desk impersonation, vendor verification, and executive requests.
Phishing Campaigns
Custom email phishing campaigns targeting specific employee groups. We create realistic emails mimicking trusted senders, internal communications, or business- critical notifications. We measure open rates, click rates, credential submission rates, and reporting rates.
Smishing (SMS Phishing)
Text message-based campaigns testing employee
responses to fraudulent SMS messages, including
fake MFA prompts, delivery notifications, and urgent management requests.
Physical Social Engineering
In-person pretexting to test whether employees challenge unknown visitors, hold doors open, or allow access to restricted areas. Often combined with physical penetration testing.
Spear Phishing
Highly targeted attacks against specific individuals (C- suite, finance, IT administrators) using detailed OSINT to craft convincing pretexts. Tests your highest-risk personnel.
Business Email Compromise (BEC) Simulation
Simulated attacks mimicking compromised executive accounts requesting wire transfers, invoice changes, or sensitive data — the most financially damaging form of social engineering.
What We Measure
Metric
What It Tells You
Email open rate
Identify all known vulnerabilities
Click-through rate
How many clicked malicious links
Credential submission rate
How many entered passwords on fake login pages
Attachment execution rate
How many opened malicious attachments
Report rate
How many reported the suspicious email to IT/security
Time to first report
How quickly your fastest responder flagged the threat
Department comparison
Which teams are most and least susceptible
Our Methodology
1
OSINT Gathering
2
Campaign Design
3
Campaign Execution
4
Metrics Collection
5
Analysis & Training
6
Reporting
Frequently Asked Questions
Won't employees be upset about being tested?
This is a common concern. When social engineering testing is framed as a learning opportunity rather than a gotcha exercise, the vast majority of employees respond positively. We recommend communicating the programme to staff after testing is complete, focusing on aggregate results rather than naming individuals. Most organisations find it builds security awareness culture rather than eroding trust
How realistic are the phishing emails?
Our phishing simulations are designed to closely mimic real-world attack scenarios. We create realistic email templates that reflect common tactics used by cybercriminals, such as fake login requests, delivery notifications, password resets, or internal company messages. This helps accurately measure how employees might respond to genuine phishing attempts.
Can you test specific departments or roles?
Yes, we can target specific departments, teams, or roles within your organization. This allows us to simulate attacks that are more relevant to those groups, such as finance-related scams for accounting teams or credential harvesting attempts for IT staff. Targeted testing helps identify higher-risk areas within your organisation.
How often should we run social engineering tests?
Most organisations benefit from running social engineering tests several times a year. Regular testing helps measure improvements in employee awareness, identify new vulnerabilities, and reinforce security best practices over time.
Do you provide training after the test?
Yes, we provide follow-up training based on the test results. Employees who interact with simulated phishing emails can receive targeted awareness training, while organizations receive insights and recommendations to improve overall security awareness.
What is a typical click rate on phishing tests?
Click rates can vary depending on the organization and employee awareness level. Many organizations see initial click rates between 10% and 30%. With regular testing and training, this rate typically decreases significantly as employees become more skilled at identifying phishing attempts.
Reduce Your Human Risk Factor
Book a social engineering assessment with Intrix Cyber Security. Call 1300 931 727.